Free tool
Data breach notification laws by state
Choose a state to see what counts as personal information, how fast individuals must be told, and whether the attorney general or a regulator must be notified.
Information, not legal advice. Rules last verified October 7, 2026. Laws change; confirm with the agency or a qualified professional before you rely on it.
What the lookup shows
- The statute and what counts as personal information
- The deadline for notifying affected residents
- Whether the attorney general or another regulator must be told, and when
- Thresholds and any risk-of-harm exception
- The source and the date we checked it
Which states are covered?
Every state in the list has been checked against an official source, which is linked with each answer, together with the date of the dataset. States marked “not checked yet” are still being researched; until they are, use the state agency’s own website. Fields we could not confirm are left out rather than guessed.
Frequently asked questions
What should I do first after a suspected breach?
Follow your incident response plan: contain the incident, preserve evidence, and bring in your privacy or legal counsel quickly, because state deadlines and definitions differ and several states may apply at once.